What Is GWEB Certification?

What GWEB Actually Certifies

GWEB stands for GIAC Certified Web Application Defender. It is a defensive application security credential: it tests whether you can recognize how web applications, APIs, and microservices get attacked, and whether you know the engineering controls that stop those attacks. If you have seen the acronym attached to other credentials elsewhere, set those aside. Everything on this page concerns the GIAC certification only. For other angles on the same question, see our shorter explainers on what GWEB is and what GWEB stands for.

The emphasis is defense. A candidate is expected to understand an attack well enough to reason about it, but the exam's center of gravity is the fix: how to validate input, encode output, constrain browsers with security headers, design authorization correctly, and configure transport and architecture so that a single mistake does not become a breach. That orientation separates it from offensive certifications that reward exploitation skill. Developers, security engineers, and architects who need to build and review resilient web systems are the natural audience.

Who Issues It and How the Attempt Works

The credential is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. Your rights and obligations as a candidate are governed by the GIAC Candidate Agreement, last updated 2025-02-18. A few mechanics are worth understanding before you buy an attempt:

• Single proctored exam. There is one web-based proctored exam. There is no separate lab practical or multi-part sequence for this certification.
• Testing providers. GIAC uses Pearson VUE for onsite testing and ProctorU for remote proctoring, depending on the modality GIAC assigns to your attempt.
• Access window. An initial standalone attempt remains available for 120 days from activation, and extensions can be purchased if you need more time under GIAC's attempt delivery policy.
• Your account is the authority. The Certification Information inside your GIAC account governs the specific objectives, question types, format, and passing score for the attempt you purchased. Check it as soon as you activate.

Eligibility is simple. No prerequisites are required to begin the certification process, and training is optional. Our GWEB requirements guide walks through the qualification details, and the GWEB exam dates article covers scheduling logistics.

The 18 Published Objective Areas

GIAC publishes eighteen objective headings for GWEB. Importantly, the source does not publish percentage weights for them, so any claim that one area is worth a specific share of the exam should be treated with suspicion. The sensible assumption is that you must be competent across the whole list. The headings, in the order GIAC presents them:

1. Access Control
2. AI/LLM and Microservices Security
3. Authentication
4. Browser Security Features and Clickjacking
5. Cloud Security and SSRF
6. Cross-Site Scripting and Cross-Site Request Forgery
7. Deserialization, Business Logic, and Concurrency
8. HTTP Protocol Introduction
9. Injection Foundations
10. MLSecOps and Threat Modeling
11. Oauth, OIDC, JWT, and SAML
12. REST and GraphQL API Security
13. Same Origin Policy, CORS, and Cross-Origin Attacks
14. Transport Security and Cryptography
15. Unicode and Internationalization Security
16. Web Architecture and Configuration
17. Web Services Security
18. XSS Defense and Client-Side Supply Chain

For a deeper treatment of every area, read the complete guide to all 18 GWEB content areas. Below are the clusters that most often shape how candidates experience the material.

The Identity and Access Cluster

The Browser and Cross-Origin Cluster

The Injection, Data, and Logic Cluster

The Infrastructure and Emerging-Technology Cluster

HTTP Protocol Introduction underpins all of it. If you are shaky on methods, headers, cookies, caching, and the request/response lifecycle, start there, because nearly every other heading assumes fluency.

Exam Format and Open-Book Rules

Three hours for 75 questions works out to a generous per-question allowance, which hints at the style: scenario-oriented items that ask you to interpret a situation and choose the right control, rather than quick recall of a term. The exact question types for your purchased attempt are stated in your GIAC account's Certification Information, so confirm them there rather than relying on third-party descriptions.

Open book is real but narrow. Paper references are allowed. Electronic references, internet access, and materials containing exam or practice Q&A are prohibited under GIAC's proctored exam reference guide. That last rule matters for how you build your reference set: an index and annotated notes organized by the eighteen headings are legitimate; a printed bank of practice questions is not. Read the GWEB passing score breakdown to understand how the 68% threshold translates into questions, and see the difficulty guide for how the format feels in practice.

Fees, Access Window, and Renewal

Costs are published by GIAC and exclude tax. The core numbers:

These figures cover the certification itself, not training. SANS course tuition is a separate and much larger expense, which is why the optional-training status matters financially. Our GWEB certification cost breakdown lays out the full picture, including how the access window and extensions affect budgeting.

The credential is valid for four years. To renew you need either 36 approved CPE credits earned during the active four-year cycle or a passing renewal exam, in both cases along with the renewal fee. Because CPE credits must accumulate over the cycle, it pays to log qualifying activity continuously instead of scrambling near expiry.

Who Benefits From the Credential

GWEB speaks most directly to people whose daily work touches application security decisions:

• Application security engineers who review designs, triage findings, and set secure coding standards.
• Software developers and architects who want to build defenses in rather than bolt them on, especially around authentication, API design, and client-side protections.
• DevSecOps and platform engineers responsible for configuration, cloud exposure, and pipeline controls.
• Security analysts and consultants who assess web applications and need to recommend credible remediations.

Employers who run public-facing web applications and APIs, including software vendors, financial and e-commerce operators, and consultancies that perform application assessments, are the likeliest to value it. We deliberately avoid quoting salary numbers here because no reliable figure comes from the issuer; the salary guide discusses what can be said qualitatively, and the GWEB jobs article covers the roles that reference it. If you are weighing the investment, the ROI analysis frames the decision.

Where SANS SEC522 Fits

The recommended preparation is the SANS course SEC522: Application Security: Securing Web Applications, APIs, and Microservices. It is recommended, not required. Candidates with strong hands-on web security backgrounds sometimes sit the exam on experience plus self-study, while others prefer the structure of a full course.

Keep two cautions in mind. First, SEC522 course sections are an unweighted preparation curriculum; they inform what to study but do not define the exam's exact coverage or its eighteen-heading structure. Second, course hours, labs, and capstones are separate from the proctored exam time. Completing the course does not shorten or change the three-hour exam. If you prefer to compare the options, our GWEB training overview discusses routes into the material.

Sequencing the Domains in Your Prep

Generic study advice is plentiful; the more useful question is the order in which to tackle GWEB's specific headings, because several build on each other. One reasonable arrangement, which you should adapt to your own background:

The logic is dependency-driven: protocol and transport knowledge first, then flaws that live on the server, then the browser trust model, then identity, and finally the architectural and emerging topics that tie everything together. For a full plan with resources, use the GWEB study guide, and build your reference sheet alongside our one-page cheat sheet. When you want to check recall under time pressure, use the GWEB practice tests and keep a log of the headings where you miss questions so your index grows exactly where you need it.

Frequently Asked Questions